WEBVTT 00:00:01.920 --> 00:00:02.660 In this demo, 00:00:02.660 --> 00:00:06.640 we'll be reviewing our PoshC2 server configuration to ensure our 00:00:06.640 --> 00:00:09.370 infrastructure is properly prepared for our attack. 00:00:09.740 --> 00:00:12.350 We will then enumerate our target company to 00:00:12.350 --> 00:00:14.600 identify potential assets to exploit, 00:00:14.780 --> 00:00:18.310 and then leverage a spear phishing attacked again initial access against our 00:00:18.310 --> 00:00:22.700 victim to place our PoshC2 implant onto a vulnerable system. 00:00:23.540 --> 00:00:25.720 We will start on our Kali attack system, 00:00:25.720 --> 00:00:28.890 which is a pre‑built VM provided by Offensive Security 00:00:28.950 --> 00:00:31.660 available on their virtual image download page. 00:00:31.940 --> 00:00:36.420 I have already installed PoshC2 onto the system using the installation 00:00:36.420 --> 00:00:40.970 script and instructions available on the PoshC2 GitHub repo. 00:00:42.040 --> 00:00:43.680 With our attack system ready, 00:00:43.690 --> 00:00:47.970 let's go ahead and review our PoshC2 server configuration to ensure 00:00:47.970 --> 00:00:51.220 we are properly prepped for our attack engagement. 00:00:51.220 --> 00:00:56.850 From the termina,l we can run the built‑in Posh command posh‑config 00:00:57.240 --> 00:01:01.770 ‑‑nano to open our server config YAML file in nano. 00:01:02.440 --> 00:01:06.790 Here we have a variety of options available to us in configuring PoshC2, 00:01:06.800 --> 00:01:11.850 which can allow us to limit the ability of an adversary to detect our attack. 00:01:11.850 --> 00:01:15.850 In order to ensure we have a working PoshC2 environment, 00:01:15.860 --> 00:01:19.510 we'll need to configure a PayloadCommsHost address, 00:01:19.520 --> 00:01:22.600 which will be the IP address of our attack system. 00:01:23.140 --> 00:01:27.670 Configuring this field will enable both the Posh implant handler and the 00:01:27.670 --> 00:01:30.900 implants residing on vulnerable systems to communicate. 00:01:30.900 --> 00:01:32.120 Scrolling down, 00:01:32.120 --> 00:01:35.390 one great feature you may want to consider tweaking is the Jitter rate. 00:01:35.940 --> 00:01:39.050 PoshC2 leverages a beacon on the implant to enable 00:01:39.050 --> 00:01:41.970 communication for our command and control activity. 00:01:42.440 --> 00:01:46.180 This helps the activity remain stealth by leveraging the Jitter rate to 00:01:46.180 --> 00:01:50.630 randomize the communication timing to a few seconds range rather than a 00:01:50.630 --> 00:01:54.710 fixed timing to throw off potential networker host detection solutions 00:01:55.000 --> 00:01:57.050 that might key off of a fixed pattern. 00:01:58.140 --> 00:01:59.720 Another feature of the beacon, 00:01:59.720 --> 00:02:02.260 which needs to be properly configured in order to run 00:02:02.260 --> 00:02:05.160 a successful attack engagement, is the KillDate. 00:02:05.720 --> 00:02:08.870 This must be set to a future day in time; otherwise, 00:02:08.870 --> 00:02:12.150 the implants will not phone home to the PoshC2 server. 00:02:13.240 --> 00:02:16.600 Now that we have our PoshC2 environment properly set up, 00:02:16.610 --> 00:02:20.050 let's find a victim to use our C2 framework against. 00:02:20.740 --> 00:02:23.600 We are going to be targeting the Globomantics corporation. 00:02:23.880 --> 00:02:27.110 Let's first open up our web browser from the terminal by typing 00:02:27.120 --> 00:02:30.500 firefox and navigate to the Globomantics website, 00:02:30.510 --> 00:02:32.350 which is flobomantics.lan. 00:02:32.350 --> 00:02:36.390 This will serve as a starting point to use publicly‑available 00:02:36.390 --> 00:02:40.580 information provide on the Globomantics website to help us enumerate 00:02:40.580 --> 00:02:43.990 our target and identify potential victims to attack. 00:02:43.990 --> 00:02:46.710 To help identify a victim to target, 00:02:46.710 --> 00:02:49.850 let's navigate to the Our story section of the website. 00:02:50.740 --> 00:02:51.980 Scrolling down the page, 00:02:51.980 --> 00:02:55.660 we see that Globomantics has provided information about their CEO. 00:02:56.240 --> 00:02:58.550 This will make a great target for our attack. 00:02:59.410 --> 00:03:02.820 Now let's navigate to our social media platform of choice to 00:03:02.820 --> 00:03:04.860 gather further information on our victim. 00:03:05.540 --> 00:03:09.840 Here we will see on the social media platform that the CEO is providing some of 00:03:09.840 --> 00:03:13.280 his personal data related to his position at Globomantics. 00:03:13.840 --> 00:03:17.130 We see that we're able to collect his Globomantics email address, 00:03:17.140 --> 00:03:20.830 which we can use to target him with a spear phishing attack as a 00:03:20.830 --> 00:03:24.070 vehicle for placing a PoshC2 implant on his system. 00:03:25.240 --> 00:03:28.660 Now let's close our browser and prepare our spear phishing attack 00:03:28.670 --> 00:03:32.260 with the information we have gathered from the company website and 00:03:32.260 --> 00:03:34.640 the victim's public social media profile. 00:03:34.640 --> 00:03:37.410 To craft and send our spear phishing attack, 00:03:37.410 --> 00:03:41.060 we will use King Phisher, which comes preinstalled on Kali Linux. 00:03:41.060 --> 00:03:49.730 From the terminal, we can type /usr/share/king‑phisher/KingPhisher, 00:03:49.740 --> 00:03:50.590 and press Enter. 00:03:51.640 --> 00:03:53.460 As the King Phisher client opens, 00:03:53.470 --> 00:03:56.050 we'll be prompted to enter credentials to access the 00:03:56.050 --> 00:03:57.850 database of the King Phisher server. 00:03:58.440 --> 00:04:01.770 Both client and server are residing on our Kali Linux system, 00:04:02.140 --> 00:04:05.090 so we can keep the server connection set to localhost. 00:04:05.750 --> 00:04:08.480 We enter our Kali user credentials with a username 00:04:08.480 --> 00:04:12.060 of kali and a password of kali, and click Connect. 00:04:12.440 --> 00:04:16.060 I have already configured a King Phisher campaign and an SMTP 00:04:16.060 --> 00:04:19.070 server for us to use in our initial access attack. 00:04:19.440 --> 00:04:19.920 However, 00:04:19.920 --> 00:04:23.400 let's scroll down to the target information and add the email address 00:04:23.410 --> 00:04:28.270 of ceo@globomantics.lan for the Globomantics CEO, 00:04:28.280 --> 00:04:31.510 which we found during our enumeration of Globomantics. 00:04:32.040 --> 00:04:36.410 Now we can scroll up to the Attachment field and load our PoshC2 payload, 00:04:36.420 --> 00:04:39.960 which we will transmit to our victim by the spear phishing attack. 00:04:40.840 --> 00:04:43.960 PoshC2 comes with a number of payloads to load the 00:04:43.960 --> 00:04:45.760 implant on to a target system. 00:04:46.220 --> 00:04:49.900 These payloads are built during the PoshC2 server installation the 00:04:49.900 --> 00:04:52.050 first time the server is running configured. 00:04:52.440 --> 00:04:55.600 We will switch from King Phisher over to the terminal and 00:04:55.600 --> 00:04:58.480 review the directory containing the payloads to identify 00:04:58.490 --> 00:05:00.570 which we want to use for our attack. 00:05:01.140 --> 00:05:04.840 These payloads are going to reside under the PoshC2 project folder I 00:05:04.840 --> 00:05:09.250 created called global‑attack when I configured my server. 00:05:09.250 --> 00:05:20.450 We type ls space /var/poshec2/global‑attack/payloads, and press Enter. 00:05:21.480 --> 00:05:22.380 Scrolling up, 00:05:22.380 --> 00:05:25.760 we see a number of different payloads to use depending on the system. 00:05:26.240 --> 00:05:29.750 Let's use the launcher.hda payload for our purposes. 00:05:29.750 --> 00:05:30.970 In the terminal, 00:05:30.970 --> 00:05:34.480 we will copy the payload to our local documents directory so we 00:05:34.480 --> 00:05:37.080 may modify it using the command cp 00:05:37.200 --> 00:05:48.760 /var/poshc2/global‑attack/payloads/launcher.hta documents. 00:05:49.840 --> 00:05:53.770 We can verify the transfer using the ls command on the directory. 00:05:54.840 --> 00:05:57.240 Now let's rename the file to something that will fit 00:05:57.240 --> 00:05:59.490 with our phishing attack on our victim. 00:06:00.240 --> 00:06:12.590 Run nv documents/launcher.hta documents/virus‑check.hta, and press Enter. 00:06:13.540 --> 00:06:16.480 We see now listing the directory again, that we have changed our 00:06:16.480 --> 00:06:20.300 file name to be more convincing to our target that this is something 00:06:20.300 --> 00:06:22.150 that should be loaded onto their system. 00:06:22.540 --> 00:06:27.640 Now let's start our PoshC2 server with the command posh‑server o 00:06:27.640 --> 00:06:31.010 prepare for our attack. Moving back to King Phisher, 00:06:31.010 --> 00:06:33.530 we will click to select our file and click on the 00:06:33.530 --> 00:06:38.060 virus‑check.hta file to load it into King Phisher. 00:06:38.640 --> 00:06:42.600 We will now navigate to the Send tab, and we're ready to send our phishing 00:06:42.600 --> 00:06:46.670 campaign to the Globomantics CEO. Click the Start button. 00:06:47.240 --> 00:06:51.470 King Phisher will prompt us for our SMTP server password, which I will enter 00:06:51.470 --> 00:06:55.580 here, and we will see that King Phisher runs through the send process and 00:06:55.580 --> 00:06:57.950 successfully sends our campaign to our target. 00:06:58.540 --> 00:07:02.430 Now let's start the Posh implant handler from the terminal by running Posh 00:07:02.500 --> 00:07:07.220 and press Ente. We can verify that the implant handler is running by 00:07:07.220 --> 00:07:11.900 checking the PoshC2 server terminal window, and we see our user of Kali is 00:07:11.900 --> 00:07:16.230 signed in. Now moving over to the system of the phishing target, we can 00:07:16.230 --> 00:07:19.600 see when we opened the email client that the attack has indeed arrived in 00:07:19.600 --> 00:07:20.850 the CEO inbox. 00:07:21.210 --> 00:07:23.700 The message appears to come from the Globomantics help 00:07:23.700 --> 00:07:27.330 desk, giving our attack validity in the eyes of the CEO, as 00:07:27.330 --> 00:07:29.050 originating from Globomantics. 00:07:29.920 --> 00:07:33.720 We see that unfortunately Globomantics has recently had a virus 00:07:33.720 --> 00:07:37.850 attack, so the CEO should download the attached file and run it on his 00:07:37.850 --> 00:07:40.540 system to ensure it has not been compromised. 00:07:40.750 --> 00:07:44.300 We will save the file to the desktop and run it as the CEO. 00:07:45.140 --> 00:07:45.600 Good. 00:07:45.720 --> 00:07:49.150 The CEO should be all safe from any potential virus now that he has done 00:07:49.150 --> 00:07:54.190 that, wink wink. Hopping back over to our attack system, we can refresh the 00:07:54.200 --> 00:07:57.970 implant handler terminal by pressing Enter. Success. 00:07:58.160 --> 00:08:01.530 We now see that the GLOBO‑PC‑01 system is in 00:08:01.530 --> 00:08:03.750 communication with the PoshC2 server. 00:08:04.300 --> 00:08:07.680 This will end our demo where we enumerated our victim through 00:08:07.680 --> 00:08:11.360 public‑available resources and crafted a spear phishing attack to 00:08:11.360 --> 00:08:15.860 carry our PoshC2 implant to our target system to establish initial 00:08:15.860 --> 00:08:19.810 access for our attack and a successful connection of our command and 00:08:19.810 --> 00:08:21.070 control infrastructure.